Rapid Weaponization, Credential Theft, and Infrastructure Compromise: This Week’s Multi-Threat Attack Campaign

Executive Summary

A significant surge in cybersecurity threats emerged this week as the Cybersecurity and Infrastructure Security Agency (CISA) officially cataloged four critical vulnerabilities across widely deployed web development and enterprise platforms, while simultaneously threat researchers documented active exploitation campaigns targeting critical infrastructure. Adobe ColdFusion, PageBuilder CK for Joomla, Langflow AI orchestration platform, and JoomShaper’s SP Page Builder were all added to CISA’s Known Exploited Vulnerabilities catalog following confirmation of weaponization in the wild, with each vulnerability enabling unauthenticated remote code execution or improper access control on vulnerable installations.

Beyond CISA’s official listings, security researchers confirmed active in-the-wild exploitation of Gitea Docker images through authentication bypass vulnerabilities and the iCagenda extension for Joomla through arbitrary file upload flaws, with automated attack tooling actively harvesting vulnerable installations within hours of patch releases and establishing persistent backdoors on compromised systems.

The threat landscape expanded further with the discovery that Storm-2603, a sophisticated financially motivated threat actor, actively exploited a critical SharePoint Server remote code execution vulnerability to compromise enterprise environments, demonstrating rapid weaponization capabilities and establishing persistence mechanisms through legitimate remote access tools and secondary implant deployment. Meanwhile, suspected China-aligned threat cluster UNK_MassTraction conducted a coordinated campaign targeting physics and engineering departments of United States and Canadian universities, leveraging cross-tenant access vulnerabilities and unauthenticated code execution flaws in Roundcube mailservers to establish network footholds and pivot into sensitive research and academic infrastructure. In parallel, Cisco Talos Intelligence uncovered UAT-7810, a China-nexus advanced persistent threat actor, actively developing and deploying a custom five-malware arsenal specifically designed to compromise unpatched networking devices and establish Operational Relay Box infrastructure that enables associated threat actors to conduct downstream attacks against high-value targets, demonstrating the convergence of supply-chain compromise tactics with critical infrastructure targeting.

1. Trending / Critical Vulnerabilities

This week’s vulnerability activity underscored the continued targeting of web application frameworks, DevOps platforms, content management systems, and collaborative development environments, reflecting sustained adversary interest in internet-facing technologies that facilitate remote code execution, unauthorized access, and long-term persistence. CISA expanded its Known Exploited Vulnerabilities (KEV) Catalog with four new entries, including CVE-2026–48282 in Adobe ColdFusion, CVE-2026–48908 in JoomShaper SP Page Builder, CVE-2026–55255 in Langflow, and CVE-2026–56290 in PageBuilder CK for Joomla, confirming active exploitation across widely deployed enterprise and web application platforms. Beyond KEV activity, active exploitation was also observed against CVE-2026–20896 in Gitea Docker images and CVE-2026–48939 in the iCagenda Joomla extension, where attackers leveraged authentication bypass, unrestricted file uploads, authorization bypass, and path traversal flaws to achieve account takeover, remote code execution, credential theft, and persistent access to compromised environments. Collectively, these developments highlighted the accelerating pace at which threat actors weaponize vulnerabilities affecting internet-facing development and content management platforms, enabling scalable compromise of enterprise infrastructure through readily exploitable security weaknesses.

2. Exploit Activity and Mass Scanning Observed on Cytellite Sensors

Cytellite observations during this period highlighted continued exploitation and emerging security risks across web-based management interfaces, enterprise communications platforms, AI application frameworks, enterprise business applications, web application servers, geospatial platforms, network security appliances, open-source software, and internet-facing services, reflecting sustained adversary interest in technologies capable of enabling remote code execution, authentication bypass, unauthorized access, and infrastructure compromise. Notably, CVE-2026–27944 in Nginx UI emerged as a critical vulnerability capable of enabling unauthenticated administrative access, although no evidence of active exploitation or CISA KEV designation has been reported. Vulnerabilities observed under active exploitation included CVE-2025–57819 in Sangoma FreePBX, CVE-2025–3248 in Langflow, CVE-2025–31324 in SAP NetWeaver Visual Composer Metadata Uploader, CVE-2024–4577 in PHP CGI, CVE-2024–36401 in GeoServer, and CVE-2024–3400 in Palo Alto Networks PAN-OS, all of which have been added to the CISA KEV Catalog and provide pathways for authentication bypass, unrestricted file upload, command injection, code injection, and remote code execution. Additional exploitation activity targeted CVE-2024–47176 in OpenPrinting CUPS and CVE-2024–23334 in aiohttp, demonstrating continued attacker focus on exposed services and application-layer weaknesses despite the absence of KEV designation. Meanwhile, CVE-2023–49103 in ownCloud graphapi remained significant due to its KEV-listed status and potential to expose sensitive configuration data and administrative credentials through information disclosure. Collectively, the observed activity underscored the continued prioritization of widely deployed enterprise technologies that provide attackers with scalable opportunities for initial access, privilege escalation, credential compromise, persistence, and broader network compromise.

3. Vulnerabilities Abused by Malware

Recent threat activity highlighted the continued convergence of vulnerability exploitation, advanced intrusion campaigns, malware deployment, and persistence operations targeting enterprise collaboration platforms, academic institutions, networking devices, and internet-facing infrastructure. According to Rescana, threat actors actively exploited CVE-2026–45659 in Microsoft SharePoint Server to execute arbitrary code through insecure deserialization, with the Storm-2603 threat group rapidly weaponizing the vulnerability to establish persistence, deploy custom backdoors, disable security solutions, and leverage legitimate remote administration tools for lateral movement across enterprise environments. Simultaneously, Proofpoint Threat Research reported that the UNK_MassTraction threat cluster exploited CVE-2024–42009 and CVE-2025–49113 in Roundcube to harvest user credentials, deploy the IceCube credential stealer, install SquareShell webshells, and establish persistent access through the SNOWLIGHT loader and VShell backdoor, supporting suspected cyber-espionage operations targeting physics and engineering departments at universities in the United States and Canada. Cisco Talos Intelligence also documented continued activity by the UAT-7810 threat actor, which exploited CVE-2020–22653, CVE-2020–22658, CVE-2023–25717, and CVE-2025–2492 in Ruckus and ASUS AiCloud routers to deploy the SHORTLEASH, LONGLEASH, DOGLEASH, and JARLEASH malware families, establishing Operational Relay Box (ORB) infrastructure that enabled encrypted command-and-control communications, proxy services, and downstream attacks through compromised networking devices.

4. OSS Trending vulnerabilities observed this week

This week’s open-source threat activity highlighted critical vulnerabilities affecting package management ecosystems, AI application frameworks, logging infrastructure, mobile operating systems, and cloud-native service discovery platforms, reinforcing persistent risks associated with insecure open-source components, exposed services, and software supply chain dependencies. Notable issues included CVE-2026–5223 in the crates.io ecosystem affecting Cargo, which improperly handled symbolic links and introduced opportunities for unauthorized file manipulation, CVE-2026–33017 in the PyPI ecosystem impacting Langflow, enabling code injection and potential remote code execution in AI application deployments, and CVE-2026–44024 in the RubyGems ecosystem affecting Fluentd, where a remote code execution vulnerability exposed logging infrastructure to compromise. Additional vulnerabilities included CVE-2025–38352 in the Android ecosystem affecting the Linux Kernel, introducing race condition flaws that could lead to privilege escalation and system instability, and CVE-2021–29441 in the Maven ecosystem impacting Nacos, where an authentication bypass vulnerability enabled unauthorized administrative access to cloud-native service discovery and configuration management environments.

5. Pre-NVDs vulnerabilities observed this week

This week’s early vulnerability disclosures revealed multiple security issues across secure access solutions, hybrid cloud infrastructure platforms, analytics services, API management applications, and web application frameworks, highlighting emerging risks across enterprise environments, cloud-native deployments, and internet-facing services. Notable findings included CVE-2026–0278 affecting Prisma Access Agent, where a protection mechanism failure could weaken endpoint security controls, and CVE-2026–13463 in IBM Cloud Pak System, which introduced a hard-coded credentials vulnerability capable of enabling unauthorized access to cloud infrastructure management environments. Additional disclosures included CVE-2026–15082 in Siteimprove Analytics, where a cross-site scripting vulnerability could enable client-side code execution, and CVE-2026–44342 in QuantumNous/new-api, which exposed applications to cross-site request forgery (CSRF) attacks capable of triggering unauthorized actions on behalf of authenticated users. CVE-2026–52889 affecting Formie also introduced a server-side template injection (SSTI) vulnerability that could allow attackers to execute arbitrary code and compromise affected web applications.

Conclusion

The week’s surge in nation-state campaigns, financially motivated exploitation, and AI-weaponized botnets reveals that vulnerability management alone is insufficient. Loginsoft Vulnerability Intelligence (LOVI) platform addresses this critical need by providing real-time vulnerability intelligence enriched with diverse sources, AI-powered threat scores, customizable alerts, and seamless API integration to correlate vulnerabilities with CISA KEV and live threat intelligence for accelerated mitigation. By aggregating pre-NVD insights, comprehensive asset mapping, and lifecycle monitoring, LOVI reduces mean time to remediation and transforms reactive patching into strategic risk prioritization. Organizations must shift from patch-centric approaches to intelligence-driven vulnerability management — LOVI enables this transformation by delivering actionable context empowering security teams to prioritize threats that matter most, ensuring resilience against accelerating risks.

For more details, check out the full report.